0

This question is an extension of How does Tor handle DNS poisoning.

After having read Introducing DNS Resolver for Tor and DNS security issues, I am a bit concerned about the riscs of using Tor (Browser) in presence of DNS spoofing/poisoning or MITM attacks.

If I have understood correctly, following happens when visiting https://example.com:

  1. Tor exit node resolves example.com to an IP, e.g. 5.5.5.5
  2. End-to-end HTTPS encryption is established between Tor browser client and example.com.

Given an evil exit node resolves the domain name to a different IP address 5.5.5.7 owned by Mallory. Then the returned site still needs to deliver a certificate as response, which most probably is self-signed and not trusted by a browser root certificate authority. Hence I would get a certificate error in case of DNS spoofing.

Doesn't that mean, I am safe concerning DNS attacks, when enforcing HTTPS with Tor?

Improve this question

1 Answer 1

Reset to default
0

Yes. You are.

I would also like to point out that your normal DNS server could perform this too, however targeted at you specifically. The Tor exit node does not know who is trying to access the website, just someone.

I would also like to point that you may want to use onion services wherever possible as they do not have this problem.

Improve this answer
2
  • Thanks! The habit of preferring onion services is also a good tipp.
    – cane_xmx3
    Mar 5, 2021 at 8:48
  • @cane_xmx3 Another thing I forgot to add: If an exit node did DNS spoofing it would be removed from the network.
    – HackerNCoder
    Mar 5, 2021 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.